bk99.de entertain the web since 1997

bk99.de
HN · DNSCurated

Google launches a public DNS resolver

Summary

Google introduces Public DNS, aiming to speed up name resolution through large caches, prefetching and resilient validation. Google Public DNS launched on 3 December 2009. The IPv4 addresses 8.8.8.8 and 8.8.4.4 were made publicly available.

Ideas

  • Resolvers translate domain names into reachable IP addresses.
  • Large distributed caches reduce repeated queries to authoritative servers.
  • Prefetching renews popular entries before they expire.
  • Randomised query parameters make forged DNS responses harder.
  • Overprovisioning limits the effect of deliberate and unexpected load peaks.
  • Public resolvers provide an alternative to the access provider's DNS service.

Insights

  • DNS performance affects almost every new web connection.
  • A central resolver improves operations but collects valuable metadata.
  • Security and speed can reward the same architectural measures.
  • Choosing infrastructure is also a decision about trust.

Facts

  • The service worked as a recursive resolver.
  • Google documented measures against cache poisoning.

Recommendations

  • Test resolver latency and failure behaviour from your own network.
  • Run local caches with clear forwarding and privacy rules.
  • Configure at least two independently reachable resolvers.

References

Read the original article

Search the Web Archive

KrebsOnSecurity · 2019

DNSpionage: When the registrar becomes the attack path

Brian Krebs reconstructs an espionage campaign that manipulated registrar accounts and DNS records to intercept the email and VPN access of numerous organisations. Netnod confirmed that its registrar account had been compromised. The attackers obtained certificates for manipulated mail destinations.

RFC · 2018

RFC 8484: DNS over HTTPS

RFC 8484 encapsulates DNS queries in HTTPS and thereby uses existing web transport and authentication mechanisms. DoH makes path-based observation and classic network diagnostics harder at the same time. Choosing the resolver remains a decision of trust.

Hostblogger · 2017

Making CAA records available in the DNS zone editor

At customers’ request, Manuel Schmitt adds the CAA resource record type to his hosting company’s DNS zone editor. The CAA type was enabled in the zone editor on 27 January 2017. According to the article, the extension came about at the request of many customers.